php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4' into PHP-8.5

Browse Source 
* PHP-8.4:
  ext/soap: Fix wrong cookie options offset calculation, using separator offset instead.
This commit is contained in:
David Carlier
2026-03-10 21:59:38 +00:00
parent f33091c972 1b61d555fb
commit f04873c1b8
3 changed files with 70 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -29,6 +29,10 @@ PHP NEWS
. Fixed bug GH-21336 (SNMP::setSecurity() undefined behavior with
NULL arguments). (David Carlier)
- SOAP:
. Fixed Set-Cookie parsing bug wrong offset while scanning attributes.
(David Carlier)
- Standard:
. Fixed bug GH-20906 (Assertion failure when messing up output buffers).
(ndossche)

10
ext/soap/php_http.c
View File

@@ -1015,23 +1015,23 @@ try_again:
char *sempos = strstr(cookie, ";");
if (eqpos != NULL && (sempos == NULL || sempos > eqpos)) {
smart_str name = {0};
int cookie_len;
zval zcookie;
size_t cookie_value_len;
if (sempos != NULL) {
cookie_len = sempos-(eqpos+1);
cookie_value_len = sempos-(eqpos+1);
} else {
cookie_len = strlen(cookie)-(eqpos-cookie)-1;
cookie_value_len = strlen(cookie)-(eqpos-cookie)-1;
}
smart_str_appendl(&name, cookie, eqpos - cookie);
smart_str_0(&name);
array_init(&zcookie);
add_index_stringl(&zcookie, 0, eqpos + 1, cookie_len);
add_index_stringl(&zcookie, 0, eqpos + 1, cookie_value_len);
if (sempos != NULL) {
char *options = cookie + cookie_len+1;
char *options = sempos + 1;
while (*options) {
while (*options == ' ') {options++;}
sempos = strstr(options, ";");

61
ext/soap/tests/bugs/cookie_parse_options_offset.phpt Normal file
View File

@@ -0,0 +1,61 @@
--TEST--
SOAP Set-Cookie option parsing starts at wrong offset due to variable shadowing
--EXTENSIONS--
soap
--SKIPIF--
<?php
if (!file_exists(__DIR__ . "/../../../../sapi/cli/tests/php_cli_server.inc")) {
echo "skip sapi/cli/tests/php_cli_server.inc required but not found";
}
?>
--FILE--
<?php
include __DIR__ . "/../../../../sapi/cli/tests/php_cli_server.inc";
$args = ["-d", "extension_dir=" . ini_get("extension_dir"), "-d", "extension=" . (substr(PHP_OS, 0, 3) == "WIN" ? "php_" : "") . "soap." . PHP_SHLIB_SUFFIX];
if (php_ini_loaded_file()) {
$args[] = "-c";
$args[] = php_ini_loaded_file();
}
// A 10-char name makes the wrong offset land exactly on the value "path=/evil",
// falsely matching it as a path attribute.
$code = <<<'PHP'
header("Content-Type: text/xml");
header("Set-Cookie: sessionkey=path=/evil;domain=good.com");
echo <<<XML
<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="test-uri">
<SOAP-ENV:Body>
<ns1:testResponse/>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>
XML;
PHP;
php_cli_server_start($code, null, $args);
$client = new SoapClient(null, [
'location' => 'http://' . PHP_CLI_SERVER_ADDRESS . '/test/endpoint',
'uri' => 'test-uri',
'trace' => true,
]);
try {
$client->__soapCall("test", []);
} catch (SoapFault $e) {
// Response parsing may fault, cookies are still stored
}
$cookies = $client->__getCookies();
// path should default to "/test" from the request URI, not "/evil" from the value.
echo "value: " . $cookies['sessionkey'][0] . "\n";
echo "path: " . $cookies['sessionkey'][1] . "\n";
echo "domain: " . $cookies['sessionkey'][2] . "\n";
?>
--EXPECT--
value: path=/evil
path: /test
domain: good.com